V2.9.1 Cryptographic authentication mechanism, protection against disclosure is not relevant

[randomstuff]

Current 2.9.1 (talking about smart cards, FIDO devices):

2.9.1 [MODIFIED, LEVEL L2 > L3] Verify that the authentication server stores the cryptographic keys used in verification are securely and protected against** disclosure**, such as using a Trusted Platform Module (TPM) or Hardware Security Module (HSM), or an OS service that can use this secure storage.

On the authentication server, these credentials are actually public keys. It is therefore not that important to protect them against disclosure. You would not need to store a public key in a TPM or HSM for this usage.

For smart card, these are actually X.509 certificates and protecting them agaisnt disclosure often does not make sense at all.

If I understand this requirement correctly, I think it is not needed.

[tghosth]

Looks like the original NIST requirement was misinterpreted:
https://pages.nist.gov/800-63-3/sp800-63b.html#5172-single-factor-cryptographic-device-verifiers

I would suggest:

"[MODIFIED, LEVEL L2 > L3] Verify that the authentication server stores the cryptographic keys used in verification such that they are protected against modification (and for symmetric keys, against disclosure). This could involve using a Trusted Platform Module (TPM), a Hardware Security Module (HSM), or an OS service that can provide this secure storage."